Maintaining Rules

This is only supported with gomboc-enterprise-skills.

Keep a rule's allowlist up to date; for example, rotating pre-approved AMIs monthly. Make the base rule easy to patch, create an ORL patch rule driven by a variable, then run a periodic workflow to apply updates.

Prerequisites

One-time setup for the maintenance loop.

Step 1: Patchable Rule

Start from the policy-as-code example and add this to the prompt so the generated rule is easy to update later:

**Important**: I will need to update the list of AMIs frequently, so make sure the rule is easy to update later.

Modified Rule

The modified rule matches the policy-as-code example, with the AMI list centralized in skip_finding for easier patching.

---
type: Ruleset
version: v1
metadata:
  name: "ensure-ami-is-in-approved-allowlist"
  display_name: "Ensure AMI is from the approved allowlist"
  description: |
    ## Description

    Ensure that EC2 instances, launch configurations, and launch templates use only
    approved AMIs. Resources referencing an AMI that is not in the allowlist will be
    flagged with an audit error but will not be automatically remediated.
  annotations:
    contributed-by: user
    provider: AWS
    resource: aws_instance, aws_launch_configuration, aws_launch_template
spec:
  template:
    language: terraform
    audit_language: ast
    skip_finding: |
      let approved_amis = ["ami-0a1b2c3d4e5f67890", "ami-0987654321fedcba0", "ami-0ff11223344556677", "ami-0abcdef1234567890", "ami-0123456789abcdef0"];
      let ami = trim($.value, "\"");
      !hasPrefix($.value, "\"") || ami in approved_amis
    remediation:
      - command: audit
        flags:
          level: ERROR
        value: "(PaC) The AMI is not in the approved allowlist. Valid AMIs are: ami-0a1b2c3d4e5f67890, ami-0987654321fedcba0, ami-0ff11223344556677, ami-0abcdef1234567890, ami-0123456789abcdef0"
  rules:
    - name: ensure-aws_instance-uses-approved-ami
      audit: |
        {{ aResource("aws_instance", anAttribute("ami")) }}

    - name: ensure-aws_launch_template-uses-approved-ami
      audit: |
        {{ aResource("aws_launch_template", anAttribute("image_id")) }}

    - name: ensure-aws_launch_configuration-uses-approved-ami
      audit: |
        {{ aResource("aws_launch_configuration", anAttribute("image_id")) }}

Step 2: Generate the Patch

Generate a patch rule that updates the allowlist from a variable:

/gomboc:fix

I have an existing rule `ensure-ami-is-in-approved-allowlist` that enforces an AMI allowlist.  I want to create a new rule that can update that existing rule using the fact that `orl` is a supported language.  The new rule should use the `vars.custom.ami_ids` variable as a comma-separated list of AMIs that should be used.  This should replace the AMI list in `skip_finding` as an EXPR-style list (see existing rule format), as well as the remediation value as human-readable text.

**Important**: The rule should skip itself (using `skip_expression`) if the variable is not set.  If skipped the `skip_reason` should be in the form "Variable 'vars.custom.ami_ids' is not defined. It should be the complete list of valid AMIs".

This prompt is simplified for demo purposes. Depending on how you set up your update workflow, you may need to add additional protections like only patching rules by name or annotation.

Rule Output Example

Update Workflow

The update workflow consists of the steps that are run repeatedly when the underlying rule needs to be updated.

Step 1: Pull updated values

Filter to images tagged Approved=true. This command returns a comma-separated list of image IDs:

Step 2: Write the variable

Take the string from the first step and replace <ami list here> in the template below. This file should be placed in the same directory as the file you will be patching. We will use ./rules for this.

Step 3: Pull

Pull both rules from the Rules Service:

If you store the rules in the workflow repository instead, skip this step.

Step 4: Patch

Now we should have the rule to be patched and the variables in ./rules, and the patch in ./patches. To patch the rules, use the following prompt:

This tells ORL to patch rules in ./rules using rules in ./patches. Variables are automatically loaded from ./rules.

Step 5: Publish

With the rule updated, run the following prompt:

This publishes the patched rule to the Rules Service.